MetaMask is a self-custody wallet, so the Secret Recovery Phrase, the password, the approvals you sign and the sites you connect to are all settings that you control and that decide how safe your funds are. This guide explains how to secure MetaMask Extension and MetaMask Mobile using the protections MetaMask documents: security alerts, custom spending caps, approval review and revocation, Snap permissions, hardware wallet pairing, auto-lock and smart account permissions. It is written for individuals with meaningful holdings and for teams that hold treasury or operational funds in MetaMask. For the wider landscape of wallet drainers and crypto scams, see the Crypto Scam and Drainer Guide; this page stays on MetaMask settings and habits.
This is an independent guide from NHI Mgmt Group, based on MetaMask's public documentation as of November 2026. It is not sponsored or reviewed by MetaMask. Product features change, so confirm settings against MetaMask's current documentation.
Key takeaways
- The Secret Recovery Phrase is the master key. MetaMask says it will never ask for it; the only legitimate times to enter it are creating, restoring or resetting a wallet inside the genuine app.
- Keep security alerts on. They are on by default, flag requests as Warning or Malicious, and are advisory, so read them before you confirm.
- Set a custom spending cap on every approval. Dapps often ask for far more than you hold; lower the amount before approving and revoke approvals you no longer need.
- Use a hardware wallet for significant funds. MetaMask documents that transactions then need physical approval on the device, so a compromised browser alone cannot move assets.
- Treat Snaps like apps. Read each permission request, be most careful with internet, transaction and key permissions, and recheck permissions after updates.
How identity and access work in MetaMask
MetaMask holds keys for your accounts on your device. Access to funds comes from the keys, not from a username at MetaMask, which is why recovery and signing decisions sit with you.
| Credential | What it unlocks | How to protect it |
|---|---|---|
| Secret Recovery Phrase (SRP) | Every account derived from that wallet, on any device | Write it down, store offline in a secure place, never type it into a website or message |
| Account private key | One account | Export only when necessary; MetaMask warns not to share it with anyone |
| MetaMask password | Unlocks the wallet on this device; with Google or Apple login, also part of recovery | Strong and unique, never reused for the linked Google or Apple account |
| Google, Apple or Telegram login (where used) | Part of recovery for social login wallets | Protect that account with strong MFA; it becomes a recovery factor |
| Hardware wallet | Signing for accounts held on the device | Keep the device and its own recovery phrase secure; confirm details on its screen |
SRP wallets and social login wallets: MetaMask's basic security tips explain that without a connected Google or Apple account, the SRP is your only recovery method and a single point of failure that MetaMask cannot access. With a connected Google or Apple account, the SRP is encrypted and split across five nodes, and your social login account and your MetaMask password become the two points of failure. In that case MetaMask advises a MetaMask password completely different from the social account password, and you can still reveal the SRP as a fallback, so guard it the same way.
Smart accounts: MetaMask documents smart accounts based on EIP-7702, which let your existing account use features such as batched transactions through the MetaMask Delegator contract without changing your address. Your SRP or private keys still control the account, and permissions you grant through it can be limited by time or amount. Grant the smallest scope that does the job.
Admin roles and privileged access: protecting the Secret Recovery Phrase
A self-custody wallet has no administrator to call. Whoever holds the SRP or a private key holds the funds, so treat them as the highest privilege credential you own.
- Know the three legitimate prompts: MetaMask lists creating a wallet (to confirm you recorded the phrase), restoring on a new device or fresh install, and resetting your password. Any other request, on any site, chat or call, is a scam signal.
- No one at MetaMask will ask: MetaMask states that it will never ask for your SRP or password, and will never ask you to verify or submit personal ID by email or direct message. Use only the official support channels listed on support.metamask.io.
- Store offline: MetaMask's tips advise writing the phrase down and storing passwords offline rather than relying on cloud services. Keep backups in more than one secure location so a fire or theft does not lock you out.
- Install only the real app: install MetaMask from the download links on MetaMask's own website or the official browser extension and mobile app stores, and bookmark MetaMask's website and support site rather than following links in messages or search adverts.
- Separate wallets by purpose: keep a "hot" account for day-to-day dapp use with small balances and hold the rest in a hardware wallet account or a separate wallet that rarely connects to sites.
- Team funds: organisations should not rely on one person's SRP. Use hardware wallets, documented custody procedures and a multi-signature or institutional custody arrangement for treasury amounts. See the Crypto Wallet Security Guide.
Integrations, API tokens and service accounts: dapps, approvals and Snaps
In a wallet, the equivalent of API tokens and service integrations are site connections, token approvals and Snaps. Each one is a standing permission that someone else can use later.
Connections and approvals
MetaMask separates two things that are often confused. Disconnecting a site ends its access to your public address and balances. Revoking an approval removes a dapp's ability to move your tokens. Disconnecting does not revoke approvals.
- Custom spending cap: when a dapp requests a token approval, MetaMask shows a custom spending cap field. MetaMask notes that the cap is not limited by your balance and that dapps often request far more than you hold. Edit it down to the amount the transaction needs.
- Read the request: on the confirmation screen, check the site name and URL, use "Verify contract details" to see the requesting contract, and "View full transaction details" to see the approval function and the "Granted to" address.
- NFT approvals: setApprovalForAll lets another address manage all your NFTs from one collection. MetaMask notes that marketplaces use it for sales, and that you should never need it to receive an NFT. Treat an unexpected request as hostile.
- Signature permits: some tokens use permit signatures (MetaMask cites EIP-3009 for tokens such as USDC) that combine approval and transfer without a separate approve transaction. A signature request can move value, so read it with the same care as a transaction.
- Review and revoke regularly: MetaMask Portfolio shows allowances and lets you revoke them on Ethereum Mainnet, Polygon and BNB Chain; MetaMask also points to block explorer token approval checkers. Each revocation is an on-chain transaction that costs gas. MetaMask suggests checking approvals regularly, for example monthly.
Snaps
Snaps are community-built extensions that add features to MetaMask, such as support for other networks, transaction insights or notifications. MetaMask's permissions article lists the permissions a Snap may request, including:
| Permission (as shown in MetaMask) | What it allows | Care level |
|---|---|---|
| Access the internet | Send and receive data with third-party servers | High: data can leave your device |
| Access the Ethereum provider | Read blockchain data and suggest transactions | High: sees activity, proposes transactions |
| Derive arbitrary keys unique to this Snap | Create keys separate from your accounts | High: reveals identity information |
| View your public key for (protocol) | Read public keys and addresses for one protocol | Medium: no control of funds |
| Display transaction insights | Decode transactions and show details | Medium: often used for security checks |
| See the origins of websites that suggest transactions | Know which site requested a transaction | Medium: useful for phishing detection |
| Store and manage data on your device | Keep encrypted data locally | Low to medium |
| Schedule and run periodic actions | Run recurring tasks | Medium |
MetaMask advises asking whether each permission fits the Snap's stated purpose, declining or uninstalling if it does not, reviewing granted permissions from the menu under Snaps, then the Snap's settings, and rechecking after updates because new versions may request more. Accounts added by Snaps cannot be recovered from your SRP, so back them up using the Snap backup guidance.
Hardware wallet pairing
MetaMask's Hardware Wallet Hub lists direct USB connection for Ledger, Trezor and Lattice, and QR-code (air-gapped) connection for AirGap Vault, Arculus, CoolWallet, D'Cent, imToken, Keycard Shell, Keystone, NGRAVE ZERO and OneKey. All work with MetaMask Extension; Keystone, Ledger and NGRAVE ZERO also work with MetaMask Mobile. MetaMask explains that approving a transaction then needs physical access to the device. Follow MetaMask's hardware wallet user guide on first setup, and always confirm the address and amount on the device screen, not only in the browser. See the Hardware Wallet Guide.
Logging and detection
MetaMask security alerts are the main built-in detection layer. MetaMask describes them as warnings raised when it detects signals linked to scams, phishing, impersonation or other harmful activity, covering tokens, addresses, websites and transactions.
- Two levels: "Warning" means potential risk; check the URL or contract through the project's official channels and confirm only if confident. "Malicious" means high-confidence harmful activity; MetaMask advises not connecting, signing or continuing.
- Advisory, not blocking: MetaMask states that alerts do not block transactions, so the decision stays with you.
- How they work: MetaMask uses on-chain analysis, ecosystem intelligence and security partners including Blockaid. With alerts on, transaction and signature requests are sent for simulation with the dapp URL, JSON-RPC method, chain ID and transaction data; MetaMask states that it does not share your SRP, private keys or other credentials.
- Coverage: MetaMask lists supported networks including Ethereum, Arbitrum, Base, BSC, Linea, Optimism, Polygon, Bitcoin and others. Take extra care on networks outside the list.
- Keep them on: alerts are on by default. Wallets created with Google, Apple or Telegram always have them on; SRP wallets can switch them off through the Basic Functionality toggle (Extension: Settings, Privacy; Mobile: Settings, Security & Privacy), which also disables other features. Leave Basic Functionality on unless you have a specific privacy design, such as your own node.
- Report misclassifications: use "See details" then "Report an issue" on a transaction alert.
- "Deceptive site ahead": MetaMask shows this warning when a site you are connecting to is flagged as deceptive; its support article explains what to do. Leave the site unless you have verified it through official channels.
Your own monitoring: review account activity and Portfolio approvals monthly, and watch for unexpected outgoing transactions. Teams should add on-chain address monitoring for treasury accounts and alert on any approval or transfer.
| Signal | Where to see it | Action |
|---|---|---|
| Warning or Malicious alert | Confirmation screen | Stop and verify through official channels; reject if Malicious |
| Unlimited or large approval | Custom spending cap field | Lower to the needed amount |
| Unexpected setApprovalForAll | Confirmation screen, "Verify contract details" | Reject |
| Stale approvals | Portfolio spending caps | Revoke |
| New Snap permissions after update | Snap settings | Review or uninstall |
Hardening baseline
| Setting or habit | Where | Baseline |
|---|---|---|
| Security alerts | On by default; Basic Functionality toggle | On |
| Auto-lock timer | Settings, Security and password, Auto lock | Short idle time, for example a few minutes |
| Default privacy settings | "Manage default settings" during onboarding; Settings, Privacy | Reviewed at setup |
| Password | Onboarding and Settings | Long, unique, not reused for any linked social account |
| Hardware wallet | Add hardware wallet | Used for significant balances |
| Spending caps | Each approval | Set to the amount needed |
| Approval review | MetaMask Portfolio | Monthly, revoke unused |
| Snaps | Menu, Snaps | Only needed Snaps, permissions reviewed |
| Device | Operating system | Full disk encryption (FileVault, BitLocker or LUKS, as MetaMask suggests), updates applied |
| Browser | Browser profile | Dedicated profile for MetaMask with minimal other extensions |
Apply MetaMask updates promptly from the official stores; updates carry security improvements.
If something goes wrong
- Install MetaMask in a separate browser, browser profile or device and create a new wallet with a new SRP, as MetaMask's response guide describes.
- Record the new SRP safely, then send remaining funds from the affected account to the new one. If a sweeper script is suspected, MetaMask advises against sending extra funds to cover gas.
- Stop using the old wallet and every account tied to its SRP.
- Revoke unlimited approvals where they were the cause, check browser history and scan the computer.
- Report to MetaMask Support through official channels and to the relevant authorities. MetaMask notes that transactions cannot be reversed.
- Beware of "recovery" offers; see the Cryptocurrency Scam Awareness Guide.
Common misconfigurations
- SRP stored digitally: a photo, cloud note or email draft of the phrase turns any account compromise into a wallet compromise. Keep it offline.
- One wallet for everything: connecting the account that holds savings to every new dapp exposes it to every approval you sign. Split hot and cold accounts.
- Default approval amounts accepted: approving the requested amount instead of a custom spending cap leaves a large standing allowance. Edit the cap every time.
- Disconnect mistaken for revoke: disconnecting a site leaves its token approvals in place. Revoke in Portfolio as well.
- Basic Functionality turned off casually: it also disables security alerts on SRP wallets. Keep it on unless you have a deliberate alternative.
- Snaps installed and forgotten: unused Snaps with internet or provider permissions remain active. Uninstall what you do not use.
- Hardware wallet confirmations not read: approving on the device without checking the address and amount on its screen removes the protection it adds.
Framework mapping
| Practice | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 |
|---|---|---|
| Protect SRP, keys and password | PR.AA-01 | IA-5, SC-12 |
| Hardware wallet signing | PR.AA-03 | IA-2 |
| Limit approvals and Snap permissions | PR.AA-05 | AC-6, CM-7 |
| Security alerts and approval reviews | DE.CM-03 | SI-4 |
| Response after compromise | RS.MA-01 | IR-4 |
Practitioner checklist
- Install MetaMask only from MetaMask's own website or the official stores, and bookmark MetaMask's website and support site.
- Store the SRP offline in at least two secure places and never enter it outside create, restore or reset.
- Use a long, unique password, different from any linked Google, Apple or Telegram account, and protect that account with MFA.
- Keep security alerts and Basic Functionality on, and reject any request flagged Malicious.
- Set a custom spending cap on every approval and revoke unused approvals in Portfolio monthly.
- Hold significant balances on a hardware wallet account and verify details on the device screen.
- Install only needed Snaps, review their permissions and recheck after updates.
- Set a short auto-lock timer, use full disk encryption and a dedicated browser profile.
- Keep a written response plan: new wallet, move funds, stop using the old SRP, report.
Standards and references
- MetaMask: Basic security tips for MetaMask users
- MetaMask: Security alerts
- MetaMask: What is a token approval?
- MetaMask: How to revoke smart contract allowances
- MetaMask: How Snap permissions work
- MetaMask: Hardware Wallet Hub
- MetaMask: Secure your wallet with privacy best practices
- MetaMask: I've been hacked or scammed
Related NHI Mgmt Group resources: Crypto Scam and Drainer Guide · Crypto Wallet Security Guide · Hardware Wallet Guide · Cryptocurrency Scam Awareness Guide